Key derivation system

1. A method comprising:

within a device:

obtaining a device security state by comparing a selection mask and a security configuration of the device, the selection mask indicating a set of desired security settings, and the security configuration indicating implemented device security settings;

retrieving a first content key stored within the device; and

deriving a second content key using the first content key and the device security state.

2. The method of claim 1 , where the device security state includes one or both of a secure boot enable state and a test port disable state.

3. The method of claim 1 , where the device security state indicates whether a device security setting has been implemented in hardware of the device.

4. The method of claim 1 , further comprising:

receiving encrypted content at an interface of the device; and

decrypting the encrypted content using the second content key.

5. The method of claim 1 , where the first content key is stored in one-time programmable memory within the device.

6. The method of claim 1 , where the selection mask specifies a subset of the security configuration that determines the device security state.

7. The method of claim 6 , where the device security configuration comprises a security bit array, the security bit array configured to store data that indicates whether security settings have been implemented on the device.

8. The method of claim 1 , where comparing the selection mask and the security configuration comprises performing a logical AND operation on at least a portion of the selection mask and at least a portion of the security configuration.

9. The method of claim 1 , where the set of desired settings comprises settings that are implemented on the device.

10. The method of claim 1 , further comprising testing security functions of the device; and

where the selection mask comprises a test mask.

11. A device comprising:

memory comprising storage for a security configuration, the security configuration indicating implemented device settings;

an interface, in data communication with the memory, the interface configured to receive a security state, the security state based on a comparison of the security configuration with a selection mask, the selection mask configured to indicate a set of desired security settings; and

logic in communication with the interface, the logic operable to:

obtain a first content key; and

execute a key derivation function with the first content key on the security state to obtain a second content key dependent upon the security state.

12. The device of claim 11 , where the security state indicates whether a device security setting has been implemented in hardware of the device.

13. The device of claim 11 , where the security configuration comprises a configuration array of bits; and

where the selection mask comprises a selection array of bits, the configuration array and the selection array being the same size.

14. The device of claim 13 , where the logic is further operable to derive the security state by performing an AND function using the configuration array and the selection array.

15. The device of claim 11 , where:

the selection mask comprises a test mask; and

the logic is further operable to execute the key derivation function with the first content key on the security state after application of the test mask to test the key derivation function.

16. A device comprising:

memory configured to store a first content key and security configuration information, the security configuration information indicating whether the device has been implemented with device security settings;

a communication interface configured to receive encrypted content from a content provider; and

logic in communication with the memory and the communication interface, the logic operable to:

obtain security state information by comparing the security configuration information and a selection mask, the selection mask configured to indicate a set of security settings to be implemented for the content provider;

derive a second content key using the first content key and the security state information; and

decrypt the encrypted content based on the second content key.

17. The device of claim 16 , where the memory is one-time programmable memory.

18. The device of claim 16 , where the device security settings include one or both of a secure boot enable state and a test port disable state.

19. The device of claim 16 , where the logic is further operable to:

obtain a third content key based upon the second content key.

20. The device of claim 19 , where the logic is further operable to decrypt the encrypted content with the third content key.